2e7a4e677e77d319bdeed4ec746fc2b943a3bc844822798c72107b9b0c88e720

Sharing

Copy URL Twitter E-mail

General

Target
Setup.exe
Size 1.1MB
Sample250622-vbzlsat1dz
SHA256 2e7a4e677e77d319bdeed4ec746fc2b943a3bc844822798c72107b9b0c88e720
MD5 a8798d73d1b309e62c913aecacd1dc5c
SHA1 bc695ed67d10c9dcf71e1315276b184a6d5da677
SHA512 ef79e1f8bec897db1a9d0cf6544893da7db739cf6c383964354a1563b08e731a3deaa2bbf66861ab97b1af491b8f4d435ff36afe4ba8e0e2d752d22546143b4a
SSDEEP 24576:T0aOqeuvvtXfvF7VLB/k0uHr8NxANc6N0TnX8LQRr13vEGcbjKV:TAMXn9VZkvIkO6N0TnX8Lyr/cb+V
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Targets

- Target
  Setup.exe
- Size 1.1MB
- SHA256 2e7a4e677e77d319bdeed4ec746fc2b943a3bc844822798c72107b9b0c88e720
- MD5 a8798d73d1b309e62c913aecacd1dc5c
- SHA1 bc695ed67d10c9dcf71e1315276b184a6d5da677
- SHA512 ef79e1f8bec897db1a9d0cf6544893da7db739cf6c383964354a1563b08e731a3deaa2bbf66861ab97b1af491b8f4d435ff36afe4ba8e0e2d752d22546143b4a
- SSDEEP 24576:T0aOqeuvvtXfvF7VLB/k0uHr8NxANc6N0TnX8LQRr13vEGcbjKV:TAMXn9VZkvIkO6N0TnX8Lyr/cb+V
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

discovery spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates processes with tasklist
  discovery
behavioral1 behavioral2
- Target
  $TEMP/Coral.potx
- Size 25KB
- SHA256 99faf1d2f1f8db9226aa8d8e79b4e85c7f41476a31c846ca2c827cab020c8d77
- MD5 98a10f3136d0820bfaeae6908af7dfae
- SHA1 7e24e3855cdb5f2ad44f92a6e9017b417b248bbe
- SHA512 fda50f4ba946ff497b5c8e3ec4b0684416b7813b81fc2b9d12cbee3fae9f8a9a13b42b5dd53dda54f570cac13baa8acecfca00ad325551e97b5c0de5e82e1f3f
- SSDEEP 768:8MJffNFrT47UuThuN0R1N4Gae0lnm5PpJLpkqlw:8wfrrT7IfXNyeYmRptlw
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral3 behavioral4
- Target
  $TEMP/Counting.potx
- Size 85KB
- SHA256 e37f14058f54b94dcca7105b9a816b1977ef330797f51f31baba3ad1bfb584b2
- MD5 015493c98c3b088a72ff4fb92a069509
- SHA1 2acf8855e386f64ae3dc71c6f593d1adca775d88
- SHA512 08806ad735797d74e5dc698337101b51976b7c19b34b992bfb0eaf0aa4b7f395c8f9ceb3c34aa9f1f1a8f9c2d22135ba292f0b6de09a23edba027247d7ecda8c
- SSDEEP 1536:jwkeSyoZatvswQSUWfgF3YohxvbHxnUUK1GokIwS6akVqgDZ7UUylg21SuhTzpQo:89SyoQkwQQc3hdno1hbheq2yq21vhT
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral5 behavioral6
- Target
  $TEMP/Filtering.potx
- Size 58KB
- SHA256 ba99c9022ca4dc044120c6fba1689296513a06bff845c3ae27635c1940df85c4
- MD5 36bbc35a7f423cce2931df992fefd4d8
- SHA1 5e2ae5260cf771c930ea93f6a67bddc472dd424b
- SHA512 c477bb0d74a208d7677dea558c0c0b59061d5d3dd9e73f6ca340a686748c96864aa2608562b2cbd71a84291108ff1c7c5f0b09d695a314e857d472c4e456d70d
- SSDEEP 1536:x0aeV6Af/S27AvB9fwvNXL5lk6Bu1cUClYLpm:x0aO/Xv7AvB9QNtAiyLpm
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral7 behavioral8
- Target
  $TEMP/Hand.potx
- Size 62KB
- SHA256 580d1e18933de27fda99abf3286af2c5ec86f77971a63fd7cac13e8eb4179c7c
- MD5 9842d515e8ecf8d5cc9c83ea4fd4ffdf
- SHA1 bb7ec828c5e87ab06e8b54e307d9df5579a7f026
- SHA512 ffb3d4fe449655ee6070c367298ac90444d420d9ed8a418064ab330e3390e73580fb477662442818bd4bf2b883dfa53eca0de21e51835d64728eafc096c517d5
- SSDEEP 1536:ugdo4RZnVG5OoeDZk+/55eiNyMh7ZyZrDedUVBt6IpZLInIuQ/:uyrnwe1kTiNy04ZedUVBnb
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral10 behavioral9
- Target
  $TEMP/Moved.potx
- Size 51KB
- SHA256 431d374c6c0469cde8894ce82a369cc369c94426db58709059f34af7dfb64ff3
- MD5 8e68aeeb86df65a69d17a6e320d2c154
- SHA1 6db361317cebb772753b8402d085550480f4c9e7
- SHA512 918eca51b22c30ecc05f2612744ecf9fb315c9e402e57bf8772db9d7ac0d644cc42f6ec0f3ed0b222acbe998b4a49ddb0ee46dd940d055b067118dca0104c982
- SSDEEP 1536:8AaonSwb4sLvnudgAr2cC16HJR8MbLZ3QEscM:hJSwLrrAr2cFHJR8+NDNM
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral11 behavioral12
- Target
  $TEMP/Narrow.potx
- Size 29KB
- SHA256 61367f6f8784362503d74053eb3f157434b806e0ea6ac3f3e069277264c5549c
- MD5 2baaaff0e8627e80687bd77f80d03225
- SHA1 0ce76077598c2a0830afe8c0b5f84f20841a729c
- SHA512 2fe953c0a2ed442abfa3acd7c94099d0f19103198224fdc93740b063c2b364c9650c26ea42c8936c0590b59cfd5c0b3e489a08dc39dd4f7fd23137fc40dbbaf7
- SSDEEP 768:IKRTwXQ5Myt/MQgDqHOFsCKTbdRsfitYj+xoVH:IKdwXQ5DFMsHNfbsfitYjZ
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral13 behavioral14
- Target
  $TEMP/Nickname.potx
- Size 98KB
- SHA256 18b7d41f15489180d449abe8072de495b268e8cc178aaee14c100af854dab444
- MD5 cc1d7a6f88b7dec04f27e80f3d415f44
- SHA1 0c7dfae6b69993fdd2e73d1bb6c128284ae91bba
- SHA512 8c55dbdfeee0480466dcf613e3c2179769c10a8fe695b30deb2ea6bc1b264bb05fabef9a00849b48adb783399b6773e356874d8b9fd6c122b5aad7d31205f520
- SSDEEP 3072:0yVKsU+cy56UT8ZBQOBVxBDVHtGzJE0bWLG:0ercy5HBO7xVTGK0bD
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral15 behavioral16
- Target
  $TEMP/Pen.potx
- Size 89KB
- SHA256 66931025a15a2cd53bd6e2f2350cb6a337eb974a77865e449ec79b8ecb554010
- MD5 be807eab90a6808b2b317d3b82509b45
- SHA1 4c0b3f34c5f53975419409976a378910dad2ddcd
- SHA512 b9b610ef34a69d79898a1ecfded8e1728f6203f3a82f121a5aa87719cfc8961e02af46bfa9da415dde5bd28096f19e859a6ad120e39bc1bd953f3000bfbf37b0
- SSDEEP 1536:VIIUXyMnfmVhdDHjpqMWPRIGHBA343I915QcrrxULTo7F0ZxaVEuj:V4XqhhCCGU4m1578xZx+
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral17 behavioral18